nordisk/monetize

7. The operator console and the command line

Every page, label and button below is as the console renders it on monetize main c9b473a5 (crates/monetize-ui-web/src/pages/*.rs, routes in app.rs:106-130), with the backend call behind it (crates/monetize-ui-server/src/serve.rs:26-203) and the gRPC service that answers. W = crates/monetize-ui-web/src, S = crates/monetize-ui-server/src.

7.1 What the console is

A client-side Leptos page served by the ONE box's own read-only backend (monetize-ui-server, the same shape as gunnar-ui-server), which talks to monetize over loopback. There are no roles: an operator is anyone signed in with a passkey (or the console is open on loopback with neither passkeys nor a token; S/auth.rs:8-13). Every write (every non-GET under /api/, the invites, a passkey registration) needs a fresh touch of the key, the step-up: the browser answers a 403 stepup with a touch and retries once (S/auth.rs:63-67; W/api.rs:50-85).

The six rules of the surface (the code names them by number in its comments):

1. One number per screen is big. Everything else is a row.
2. Never a wall of text. A paragraph lives behind a badge you tap.
3. Plain words on the surface, jargon underneath. "wall", not Enforced; a test forbids monetize.toml, the poller, MONETIZE_UI_ on a page (W/pages/mod.rs:94-138).
4. A trend is one line: ▲ 12 GiB/wk · Full in ~9 weeks, with its uncertainty (~).
5. Sort by who needs attention, never alphabetically.
6. Outcomes, not steps. Sold bob 90 GiB · 1 980.00 SEK is the row; the ledger steps live behind a disclosure.

On every page: the top bar (W/app.rs:90-104) with the brand "monetize" (to /), the estate picker (Pick an estate, grouped by product, from GET /api/estates), the links Overview, Accounts, Guardian, Test buy, Sites, Iron, and the "You ▾" menu (the user name or "unlocked console", a "Passkeys" link, a "Log out" button). The CODE RED banner reads GET /api/code-red every 10 s and shows each line with its "Next: …" and an "Ack" button (POST /api/code-red/{key}/ack → EstateOrder.AckCodeRed). Estate pages hold one live feed (GET /api/events, an Events.Watch stream; a 5 s poll when the stream is gone) and show "live", "connecting …" or "feed ended".

7.2 The pages

Passkeys, /login (W/pages/login.rs)

Join, /invite (W/pages/invite.rs)

"Join this console · An operator invited you." Field Device label (optional), button Register my passkey (POST /auth/invite/start {secret, label} → WebAuthn → POST /auth/passkey/register/finish).

Overview, / (W/pages/overview.rs)

"Overview · Every estate. Pick one to work in it." (GET /api/overview → Estates.Overview; GET /api/estates/{e}/summary per row.)

The estate shell, /e/<estate>/… (W/pages/shell.rs)

Sidebar: the estate name and its serving badge ("checking …", "not responding", "monetize · · N paid at the vendor need you"); the menu Map, Customers, Money (with Tax), Offer, Events, Settings.

Map, /e/<e>/map (W/pages/shell.rs:117-178)

" · Map · Front, main and twin, and how each is doing now."

Customers, /e/<e>/customers[?product=] (W/pages/tenants.rs)

" · Customers". Panel "Tenants", sort: closest to cap (id, figure, bar, word, a state badge); panel "Recently bought" with the link all activity →; panels "Silent" and "Friction". Empty states: "No products", "No tenants yet", "Nothing bought yet". (GET /api/products, GET /api/products/{p}/tenants?estate=.)

Customer, /e/<e>/customer?product=&tenant= (W/pages/tenant.rs)

Money, /e/<e>/money[?product=&tenant=] (W/pages/ledger.rs, money.rs)

" · Money". Every money button is a MoneyAction: the first press arms it and asks for the words it records, the second press confirms, Cancel disarms (W/pages/money.rs:14-86).

Tax, /e/<e>/tax (W/pages/tax.rs)

"Tax owed per country, as each payment recorded it. Nothing is filed for you: these are the figures to enter." Buttons ← / → step the year; the period buttons (GET /api/tax/periods?year= → Tax.Periods); the table "Tax return boxes" (Box, Label, Amount; GET /api/tax/report → Tax.Report); link Download .csv.

Offer, /e/<e>/offer (W/pages/products.rs:126-169)

"Prices, terms, and what a customer is offered." Panel "Prices" (Product, Country, Disk as "free" or "X / GiB / period"; the policy line "billed per … · N days of grace · kept N days after that"); panel "Bundles" (field Customer, button Show offer → Purchase.Bundles; table Bundle, Price, Can serve).

Events, /e/<e>/events (W/pages/ledger.rs:128-168)

"Newest first: refused payment messages and every ledger step." The refused webhook deliveries (CallbackAdmin.ListRefusals) and the panel "Ledger steps" (Ledger.Query).

Settings, /e/<e>/settings (W/pages/settings.rs)

"Current settings. They change with an install or upgrade." Panels "Payment keys" (Stripe live/test, every vendor), "Names" (Estate, Reached at, Serves, Clouds), "Keys" ("This console signs with" a fingerprint, or "no key: a loopback bearer"; "Answering"), "Passkeys" (label · operator · since · last used · DISABLED; Sign every session out… / Confirm: sign out everywhere → POST /auth/sessions/revoke-all), "Backup" (Back up now… / Confirm: export the ledger → Ledger.Export).

Accounts, /accounts and /account?product=&tenant= (W/pages/accounts.rs)

"Every account, by product and customer." (Accounts.List.) One account: table "Rows" (kind, plan / stop, host, last heard, billing, since) with the server-offered settles Set up again / Confirm: set it up again and Refund / Confirm: refund the order (POST /api/estate-orders/{company}/settle → EstateOrder.Settle; offered for a run in phase owed or held), a private row's Setup log / Hide the setup log (Accounts.InstanceLog); table "Payments" (when, reference, outcome, what).

Guardian, /guardian and /guardian/estate?instance= (W/pages/guardian.rs)

"Repair cases for every estate. Auto-fix is off unless turned on." Table "Estates" (estate, product, main, twin, auto-fix, open case; Guardian.Cases). One estate:

Test buy, /test-buy (W/pages/test_buy.rs)

"Buy as a customer would. A real account (and machines, for a private instance) is made. Each button says what it costs." One panel per product with the product's declared test actions (Gunnar: hosted-10gb, private-small; Holger: repository-10gb, private-small); the button reads " · " and adds " · LIVE — you will be charged" on a live key; disabled with its reason ("a test buy needs an admin passkey"). Press: POST /api/test-purchase/start → TestPurchase.Start (chapter 1 §1.2). Panel "Runs" (started, product, action, account, instance, state, where); a run shows "mail goes to …" and, on a live key, the link "LIVE — you will be charged: pay at the vendor's page".

Sites, /sites (W/pages/sites.rs)

"Your own sites. Ordering one sets it up; what it costs is on its row."

Iron, /iron (W/pages/iron.rs)

"The cloud account: every estate's machines, disks and backups, and what no order owns." One panel per cloud account; per estate the owned rows (id, size, where, ref) and the backup lines; "Needs you · N" tasks (orphans, missing). (GET /api/iron → Products.List

• Usage.Fleet.)

7.3 Sessions and sign-in

The session cookie is __Host-monetize_ui_session, HttpOnly, 12 h; the step-up window is the identity core's (S/auth.rs:37-61). Passkeys, the session MAC key and the revocation epoch live in <data>/monetize-ui/state.redb. The identity core (nornir-identity) is a private site, invite only, no mail: the inviter hands the link over. The break-glass token (console_admin_token, fed by the kit) enrols the FIRST operator only; the door's POST /passkeys/reset disables every passkey so it can be used again. With neither passkeys nor a token the console runs open and refuses to bind anywhere but loopback. A standalone monetize-ui-server has no operator client: refunds, settles, the site verbs, CODE RED, logs and plugins work only in the ONE box's console (S/main.rs:234-240; crates/monetize-admin/src/console.rs:103-115).

7.4 The command line: monetize

crates/monetize-cli. Every command is ONE request at the box's door :8475 over mutual TLS with the operator's installer certificate (--door/MONETIZE_DOOR, --material/MONETIZE_MATERIAL); the door forwards it to monetize with the box's operator bearer. "Every answer is the box's own; this tool decides nothing." The kit runs it as cargo xtask site|estate|box …. There is no feed verb: the feed is the kit's cargo xtask feed (PUT /feed), chapter 2 §2.4.

The door's other routes the kit uses (crates/monetize-admin/src/door.rs:1868-1957): PUT/GET /feed (the GET returns key names only), PUT /feed/next, GET /feed/applied, GET /offer, POST /passkeys/reset, POST /attach/token, POST /attach/revoke, POST /restore, GET /money/log (the money lines, 2000 by default, ?tail=N up to 50 000).

7.5 The alert mail

Every line monetize writes for its operator starts ALERT <code> (chapter 9). PID 1 hears it, keeps it by its code and mails it to secret.alert_to through the box's own relay (secret.smtp_url): the first mail at once, then at most one per 10 min per code; code-red never waits and stays raised on the console's banner until the step that clears it succeeds (crates/monetize-admin/src/alerts.rs:1-45). The money lines (signup, callback, reconcile, nonpay, card check, payment, purchase, renewal, refund, site order, estate order, test run) are also kept at <data>/money/lines.log (8 MiB, rotated once).